bloombase spitfire storesafe qlogic 10gbe ethernet adapter interoperability
DESCRIPTION
Interoperability of Bloombase Spitfire StoreSafe Security Server and QLogic 10GbE Ethernet Adapter for Transparent Network Attached Storage (NAS) EncryptionTRANSCRIPT
Bloombase Interoperability Program P1 © 2012 Bloombase Technologies
Interoperability of Bloombase
Spitfire StoreSafe Security
Server and QLogic 10GbE
Ethernet Adapter for
Transparent Network Attached
Storage (NAS) Encryption
February, 2012
Executive Summary
QLogic enterprise grade 10GbE ethernet adapters / network interface cards (NIC) are validated by Bloombase's interopLab to run with Bloombase Spitfire StoreSafe Security Server to secure CIFS, Samba and NFS Network Attached Storage (NAS) by state-of-the-art encryption. This document describes the steps carried out to test interoperability of QLogic 10G NICs with Bloombase Spitfire StoreSafe Encryption Server on SpitfireOS running on Intel x86-based server appliances. Host systems on Microsoft Windows and Red Hat Linux are validated with QLogic 10G NIC-powered Bloombase Spitfire StoreSafe Storage Encryption appliances securing NetApp FAS2240 unified storage system.
Bloombase Interoperability Program P2 © 2012 Bloombase Technologies
Information in this document, including URL and other Internet Web site references, is subject to change without notice. Unless otherwise noted, the example companies, organizations,
products, people and events depicted herein are fictitious and no association with any real company, organization, product, person or event is intended or should be inferred. Complying
with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a
retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of
Bloombase Technologies.
Bloombase Technologies may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as
expressly provided in any written license agreement from Bloombase Technologies, the furnishing of this document does not give you any license to these patents, trademarks,
copyrights, or other intellectual property.
This document is the property of Bloombase Technologies. No exploitation or transfer of any information contained herein is permitted in the absence of an agreement with Bloombase
Technologies, and neither the document nor any such information may be released without the written consent of Bloombase Technologies.
© 2012 Bloombase Technologies
Bloombase, Bloombase Technologies, Spitfire, StoreSafe are either registered trademarks or trademarks of Bloombase Technologies in the United States and/or other countries.
The names of actual companies and products mentioned herein may be the trademarks of their respective owners.
The interoperability tests in this report are carried out at Bloombase interopLab with sponsor from QLogic Corporation.
About QLogic
QLogic is a leading supplier of high-performance storage networking solutions, which include controller chips, host adapters and fabric switches that are the backbone of storage
networks for most Global 2000 corporations. The company delivers a broad and diverse portfolio of products that includes Fibre Channel HBAs, blade server embedded Fibre Channel
switches, Fibre Channel stackable switches, iSCSI HBAs, iSCSI routers and storage services platforms for enabling advanced storage management applications. For more information,
refer to http://www.qlogic.com
Document No.
Bloombase Interoperability Program P3 © 2012 Bloombase Technologies
Table of Contents
Table of Contents 3
Purpose and Scope 5
Assumptions 6
Infrastructure 7
Setup ............................................................................................................. 7 Bloombase Spitfire StoreSafe Storage Encryption Server Appliance .................. 8 10GbE Ethernet Adapters ................................................................................. 9 Interconnects ................................................................................................. 9 Network Attached Storage (NAS) ...................................................................... 9 Storage Area Network (SAN) ............................................................................ 9 Storage Hosts ................................................................................................ 10
Configuration Overview 11
QLogic 10GbE Ethernet Adapter ...................................................................... 11 Interconnects ................................................................................................ 13 Bloombase Spitfire StoreSafe Security Server ................................................. 14
Encryption Key Configuration ........................................................................... 14 Virtual NAS Configuration ................................................................................ 15 Physical Storage Configuration ......................................................................... 16 Encrypted Virtual Storage Provisioning ..............................................................17
Bloombase Interoperability Program P4 © 2012 Bloombase Technologies
Validation Tests 20
Test Scenarios .............................................................................................. 20 Validation Matrix ............................................................................................. 20 File System Tests ............................................................................................. 21 Application Tests – Oracle Database Server ....................................................... 22
Result .......................................................................................................... 22 File System Tests ............................................................................................. 22 Application Tests – Oracle Database ................................................................. 23
Conclusion 25
Acknowledgement 26
Disclaimer 27
Technical Reference 28
Bloombase Interoperability Program P5 © 2012 Bloombase Technologies
Purpose and Scope
This document describes the steps necessary to integrate QLogic 10GbE NICs with Bloombase Spitfire StoreSafe enterprise
storage security server to secure sensitive corporate business data stored at Network Attached Storage (NAS). Specifically,
we cover the following topics:
● Preparing Bloombase Spitfire StoreSafe Security appliance(s) with QLogic 10GbE NIC(s)
● Preparing NAS storage system
● Interoperability testing on host systems including Red Hat Linux and Microsoft Windows
Bloombase Interoperability Program P6 © 2012 Bloombase Technologies
Assumptions
This document describes interoperability testing of QLogic powered Bloombase Spitfire StoreSafe Security Server appliance
on NAS storage sub-system. Therefore, it is assumed that you are familiar with operation of storage systems and major
operating systems including Linux, and Microsoft Windows. It is also assumed that you possess basic UNIX administration
skills. The examples provided may require modifications before they are run under your version of UNIX.
As QLogic 10GbE ethernet adapters are hardware option to Bloombase Spitfire StoreSafe storage encryption system, you are
recommended to refer to installation and configuration guides of specific model of QLogic 10G NIC for the platform you are
going to test on. We assume you have basic knowledge of storage networking and information cryptography. For specific
technical product information of Spitfire StoreSafe, please refer to our website at http://www.bloombase.com or Bloombase
SupPortal http://supportal.bloombase.com
Bloombase Interoperability Program P7 © 2012 Bloombase Technologies
Infrastructure
Setup The validation testing environment is setup as in below figure
Bloombase Interoperability Program P8 © 2012 Bloombase Technologies
Microsoft Windows
Server 2008 on Dell
PowerEdge R510 with
QLogic 10G NIC
Red Hat EL5 on IBM
x3650 with QLogic
10G NIC
Bloombase Spitfire
StoreSafe on HP
Proliant DL380
xSeries 365
0
1
2
3
4
5
FC
HP
ProLiant
DL380G5
UID 1 2
1 2 3 4 5 6 7 8
DIMMS
PCI
RISER
CAGE
FANS
PROCPROC
PP
M
PP
M
INTERLOCK
OVERTEMP
MIRROR
ONLINESPARE
POWER
SUPPLY
POWER
SUPPLY
NetApp FAS2240
Plain
text
Cisco SFP-H10GB-CU3M
Cisco SFP-H10GB-CU3M
FAS2240-2FAS2240-2
Storage data in
ciphered form7^&aK
`@Y4
QLogic 10G NICQLogic FC HBA
Cisco SFP-H10GB-CU3M
Microsoft Windows
Server 2008 on Dell
PowerEdge R510 with
QLogic 10G NIC
Storage data in
ciphered form7^&aK
`@Y4
Bloombase Spitfire StoreSafe Storage Encryption
Server Appliance
Bloombase Interoperability Program P9 © 2012 Bloombase Technologies
Server HP Proliant DL380
Processors 2 x Intel Xeon 5600-series quad-core 3.6 GHz
Memory 8 GB
Operating System Bloombase SpitfireOS 5.5 – Hardened and customized OS based on Linux kernel version 2.6.26 64-bit
Storage Encryption Software Bloombase Spitfire StoreSafe Security Server
10GbE Ethernet Adapters
Model QLogic QLE3242
Speed 10 Gbps
Interface PCI-E
Interconnects
Model Cisco SFP-H10GB-CU3M (37-0961-03) 10GBASE-CU SFP+ 3m Twinax Cable
Link Speed 10 Gbps
Network Attached Storage (NAS)
NAS Storage Microsoft Windows Server 2008 on Dell PowerEdge R510 with QLogic 10G NIC
Link Speed 10 Gbps
Storage Area Network (SAN)
SAN Storage NetApp FAS2240
Link Speed 8 Gbps
Bloombase Interoperability Program P10 © 2012 Bloombase Technologies
Storage Hosts
Model Dell PowerEdge R510 IBM x3650
Operating System Microsoft Windows Server 2008 Red Hat EL5
Ethernet Adapter QLogic QLE3242 QLogic QLE3242
Bloombase Interoperability Program P11 © 2012 Bloombase Technologies
Configuration Overview
QLogic 10GbE Ethernet Adapter QLogic 10G NICs
● QLogic QLE3242
are installed onto the Intel x86-based appliance running Bloombase SpitfireOS 5.5 and other storage hosts running
Windows Server 2008 and Red Hat Enterprise Linux 5
Bloombase Interoperability Program P12 © 2012 Bloombase Technologies
QLogic 1/10 GbE Converged/Intelligent Ethernet Driver v5.0.24
qlcnic 0000:01:00.0: 2MB memory map
qlcnic 0000:01:00.0: phy port: 0 switch_mode: 0,
max_tx_q: 1 max_rx_q: 8 min_tx_bw: 0x0,
max_tx_bw: 0x64 max_mtu:0x2580, capabilities: 0xeea0fae
qlcnic 0000:01:00.0: Supports FW dump capability
qlcnic 0000:01:00.0: firmware v4.9.34
qlcnic: 00:0e:1e:06:eb:f0 3200 Series Dual Port 10Gb Intelligent Ethernet Adapter Board Chip rev
0x58
qlcnic 0000:01:00.0: using msi-x interrupts
qlcnic 0000:01:00.0: eth2: XGbE port initialized
qlcnic 0000:01:00.1: 2MB memory map
qlcnic 0000:01:00.1: phy port: 1 switch_mode: 0,
max_tx_q: 1 max_rx_q: 8 min_tx_bw: 0x0,
max_tx_bw: 0x64 max_mtu:0x2580, capabilities: 0xeea0fae
qlcnic 0000:01:00.1: Supports FW dump capability
qlcnic 0000:01:00.1: firmware v4.9.34
qlcnic 0000:01:00.1: using msi-x interrupts
qlcnic 0000:01:00.1: eth3: XGbE port initialized
lspci :
01:00.0 Ethernet controller: QLogic Corp. Unknown device 8020 (rev 58)
01:00.1 Ethernet controller: QLogic Corp. Unknown device 8020 (rev 58)
01:00.0 0200: 1077:8020 (rev 58)
01:00.1 0200: 1077:8020 (rev 58)
lsmod:
qlcnic 152592 0
Server 1:
# ethtool eth3
Settings for eth3:
Supported ports: [ TP FIBRE ]
Supported link modes:
Supports auto-negotiation: No
Advertised link modes: 10000baseT/Full
Advertised auto-negotiation: No
Speed: 10000Mb/s
Duplex: Full
Port: Twisted Pair
PHYAD: 1
Transceiver: external
Auto-negotiation: off
Supports Wake-on: d
Wake-on: d
Current message level: 0x00000000 (0)
Link detected: yes
Server 2:
# ethtool eth5
Settings for eth5:
Supported ports: [ TP FIBRE ]
Supported link modes:
Supports auto-negotiation: No
Advertised link modes: 10000baseT/Full
Advertised auto-negotiation: No
Speed: 10000Mb/s
Bloombase Interoperability Program P13 © 2012 Bloombase Technologies
Duplex: Full
Port: Twisted Pair
PHYAD: 1
Transceiver: external
Auto-negotiation: off
Supports Wake-on: d
Wake-on: d
Current message level: 0x00000000 (0)
Link detected: yes
Interconnects Cisco SFP-H10GB-CU3M 10GBASE-CU SFP+ 3m Twinax Cables are used to establish 10Gbps interconnects between host,
Spitfire StoreSafe Security Server and NAS.
Bloombase Interoperability Program P14 © 2012 Bloombase Technologies
Bloombase Spitfire StoreSafe Security Server Spitfire StoreSafe supports both file-based and block-based on-the-fly storage encryption. In this interoperability test
exercise, NAS file-based encryption is validated with QLogic 10G NICs.
Encryption Key Configuration
Generate encryption key with name ‘key’ in bundled Spitfire KeyCastle key life-cycle management tool
Bloombase Interoperability Program P15 © 2012 Bloombase Technologies
Virtual NAS Configuration
Bloombase Spitfire StoreSafe file-based virtual storage and physical storage settings are configured as followings.
Bloombase Interoperability Program P16 © 2012 Bloombase Technologies
Physical Storage Configuration
Windows Server 2008 CIFS/Samba file share is provisioned at Bloombase Spitfire StoreSafe Security Server management
console.
Bloombase Interoperability Program P17 © 2012 Bloombase Technologies
Encrypted Virtual Storage Provisioning
Virtual storage namely ‘remote01’ of type ‘File’ is created to virtualize physical storage ‘remote-emc01’ for application
transparent bump-in-the-wire encryption protection over CIFS.
Bloombase Interoperability Program P18 © 2012 Bloombase Technologies
Protection type is specified as ‘Privacy’ and secure the CIFS share using AES-XTS 256-bit encryption with encryption key
‘key’
Provision authorized storage user to access virtual storage and assign to access control list
Bloombase Interoperability Program P19 © 2012 Bloombase Technologies
Bloombase Interoperability Program P20 © 2012 Bloombase Technologies
Validation Tests
Test Scenarios
Validation Matrix
Validation tests span across models of QLogic 10G NICs, Bloombase Spitfire StoreSafe Security Server, appliance hardware
platform, and host platform.
Test Condition Candidate
HBA ● QLogic QLE3242
Interconnects ● Cisco SFP-H10GB-CU3M 10GBASE-CU SFP+ 3m Twinax Cable
Storage System ● NetApp FAS2240
● Microsoft Windows Server 2008
Storage Encryption Appliance ● Bloombase Spitfire StoreSafe Security Server on x86-based HP Proliant
DL380
Host Server Hardware ● Dell PowerEdge R510
Bloombase Interoperability Program P21 © 2012 Bloombase Technologies
● IBM x3650
Host Operating Systems ● Microsoft Windows Server 2008
● Red Hat EL 5
File System Tests
The following tests are carried out at storage hosts to access encrypted NAS storage via QLogic powered Bloombase Spitfire
StoreSafe appliances via CIFS and/or NFS
● ext3 for Linux
● NTFS for Microsoft Windows
● JFS for IBM AIX
● UFS for Solaris
Test Description
Directory creation Platform equivalence of UNIX's mkdir
Directory rename Platform equivalence of UNIX's mv
Directory removal Platform equivalence of UNIX's rm
Directory move Platform equivalence of UNIX's mv
File creation Platform equivalence of UNIX's echo XXX >
File rename Platform equivalence of UNIX's mv
File removal Platform equivalence of UNIX's rm
File move Platform equivalence of UNIX's mv
File append – by character Platform equivalence of UNIX's echo XXX >>
File append – by block Platform equivalence of UNIX's echo XXX >>
File parameters inquiry Platform equivalence of UNIX's ls *X
File permission configurations ● Platform equivalence of UNIX's chmod
● Valid for UNIX-based storage host systems only (Linux, AIX, HPUX,
Bloombase Interoperability Program P22 © 2012 Bloombase Technologies
Solaris)
Softlink/Symbolic link removal ● Platform equivalence of UNIX's rm
● Valid for UNIX-based storage host systems only (Linux, AIX, HPUX,
Solaris)
Softlink/Symbolic link move ● Platform equivalence of UNIX's mv
● Valid for UNIX-based storage host systems only (Linux, AIX, HPUX,
Solaris)
Application Tests – Oracle Database Server
Test Remarks
Database creation Version equivalence of CREATE DATABASE
Schema creation Version equivalence of CREATE TABLE
Database record insert Version equivalence of INSERT INTO
Database record query Version equivalence of SELECT * FROM
Database record update Version equivalence of UPDATE
Database record delete Version equivalence of DELETE FROM
Index creation Version equivalence of CREATE INDEX
Tablespace alteration Version equivalence of ALTER TABLESPACE
Redo log creation Automated by Oracle data server, verify by examining Oracle system log
Redo log rotation Automated by Oracle data server, verify by examining Oracle system log
Archive log creation Automated by Oracle data server, verify by examining Oracle system log
Result
File System Tests
Test Validation Pass Remarks
Directory creation
Bloombase Interoperability Program P23 © 2012 Bloombase Technologies
Directory rename
Directory removal
Directory move
File creation
File rename
File removal
File move
File append – by character
File append – by block
File parameters inquiry
File permission configurations
Softlink/Symbolic link removal
Softlink/Symbolic link move
Application Tests – Oracle Database
Test Validation Pass Remarks
Database creation
Schema creation
Database record insert
Database record query
Database record update
Database record delete
Index creation
Tablespace alteration
Redo log creation
Redo log rotation
Bloombase Interoperability Program P24 © 2012 Bloombase Technologies
Archive log creation
Bloombase Interoperability Program P25 © 2012 Bloombase Technologies
Conclusion
QLogic 10G NICs
● QLogic QLE3242
pass all Bloombase interopLab's interoperability tests with Bloombase Spitfire StoreSafe enterprise storage encryption
server
Bloombase Product Operating System QLogic 10G NIC
Bloombase Spitfire StoreSafe Security Server Microsoft Windows Server 2008 QLE3242
Red Hat Enterprise Linux 5 QLE3242
Bloombase Interoperability Program P26 © 2012 Bloombase Technologies
Acknowledgement
We would like to thank QLogic Corporation for sponsoring and supporting the 10G NICs used in tests of this technical report.
Bloombase Interoperability Program P27 © 2012 Bloombase Technologies
Disclaimer
The tests described in this paper were conducted in the Bloombase InteropLab. Bloombase has not tested this configuration
with all the combinations of hardware and software options available. There may be significant differences in your
configuration that will change the procedures necessary to accomplish the objectives outlined in this paper. If you find that
any of these procedures do not work in your environment, please contact us immediately.
Bloombase Interoperability Program P28 © 2012 Bloombase Technologies
Technical Reference
1. Bloombase Spitfire StoreSafe Security Server Technical Specifications,
http://www.bloombase.com/content/8936QA88Dh3lD3kYMVKxe1VGb8UG4900eNL8Dj
2. Bloombase Spitfire StoreSafe Security Server Compatibility Matrix,
http://www.bloombase.com/content/8396639C9Q8dke046yZ3i7Yvfa6iaCNvwpZ81x
3. dd for Microsoft Windows, http://software.intel.com/en-us/articles/dd-for-windows/
4. Oracle database server, www.oracle.com/us/products/database
5. Transaction Processing Performance Council, http://www.tpc.org/tpcc/
6. QLogic 10G NICs, http://www.qlogic.com/Products/adapters/Pages/IntelligentEthernetAdapters.aspx